diff options
| author | Francois Berder <[email protected]> | 2026-05-11 21:55:31 +0200 |
|---|---|---|
| committer | Jerome Forissier <[email protected]> | 2026-06-03 17:22:24 +0200 |
| commit | 4ba29d709419a567832276f80592d28f42e965b2 (patch) | |
| tree | 0d3de2f5cda76b2e3ddf16209271c3f072684b79 /scripts | |
| parent | a38bf2121a398538730cd42a0cf3db8f80119c62 (diff) | |
net: dhcpv6: Prevent buffer overflow during BOOTFILE_URL parsing
The net_boot_file_name is a 1024 byte buffer.
However, based on DHCPv6 RFC, bootfile-url length is
specified by option_len, a 16-bit unsigned integer
(valid range: 0-65535).
Hence, one needs to make sure that option_len is less
than the size of net_boot_file_name array before copying
bootfile-url to net_boot_file_name.
Signed-off-by: Francois Berder <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions